         private-key  (utils/get-private-key keypair)
         x500-name    (utils/cn master-certname)
         ca-x500-name (utils/cn ca-name)
-        [not-before
-         not-after]  (cert-validity-dates ca-ttl)
+        validity     (cert-validity-dates ca-ttl)
         hostcert     (utils/sign-certificate ca-x500-name ca-private-key
                                              (next-serial-number! serial-file)
-                                             not-before
-                                             not-after
+                                             (:not-before validity)
+                                             (:not-after validity)
                                              x500-name public-key
                                              extensions)]
     (write-cert-to-inventory! hostcert inventory-file)

  "Settings from Puppet that are necessary for CA initialization
   and request handling during normal Puppet operation.
   Most of these are Puppet configuration settings."
  {:autosign              (schema/either schema/Str Boolean)
   :allow-duplicate-certs Boolean
   :cacert                schema/Str
   :cacrl                 schema/Str
   :cakey                 schema/Str

   csr-fn :- (schema/pred fn?)
   {:keys [ca-name capub cakey signeddir ca-ttl serial cert-inventory]} :- CaSettings]
  (let [csr         (utils/pem->csr (csr-fn))
        validity    (cert-validity-dates ca-ttl)
        signed-cert (utils/sign-certificate (utils/cn ca-name)
                                            (utils/pem->private-key cakey)
                                            (next-serial-number! serial)
                                            (:not-before validity)
                                            (:not-after validity)
                                            (utils/cn subject)
                                            (utils/get-public-key csr)
                                            (create-agent-extensions
